Issue #9837: Default parameter removes certificates found via cert_find._cert_search - freeipa

freeipa

#9837 Default parameter removes certificates found via cert_find._cert_search

Closed: fixed Jan 26, 2026 by rjeffman. Opened Jul 31, 2025 by dhanina.

ipa cert-find doesn't list all certificates. There's a rule, that if one search method _ca_search, _ldap_search, reports complete result, then the next search removes some of the old entries. However _ca_search reports as complete whenever sizelimit is set (which always falls back to at least a default value, therefore always getting deleted).

Namely this breaks the idviews useroverrides, probably some more.

Reproducer:

dnf install -y freeipa-server
CERT=MIIDNjCCAh6gAwIBAgIBDzANBgkqhkiG9w0BAQsFADAsMR0wGwYDVQQKDBRFeGFtcGxlIE9yZ2FuaXphdGlvbjELMAkGA1UEAwwCQ0EwHhcNMjAxMTEzMTQxNzM3WhcNMjExMTEzMTQxNzM3WjA5MR0wGwYDVQQKDBRFeGFtcGxlIE9yZ2FuaXphdGlvbjEYMBYGA1UEAwwPY2xpZW50LmlwYS50ZXN0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxDbnMaPtDvwi7PRysBExSIIegDeilsUpXNrfRzPnlwFEkQou/fOR8VIHbOFlb4WjShh7bqprsTBTeD3wvdObB3bWAv2GROkmLFWAU1ry7GYObE1dtNvNGp0hYJsgkGoWgy5hO1Zjp67lfkR02TJoSiiciEt4EkvFpKmLmEM5+5ShVm5YMjBIrT4DZsgk0IfUVvu2Ocb3sNaJuUhK7BEF6R8tRFZC+yI/kBCvZESaq69yljVdVI4ky4Zx4NnoQK7PdledIFvRZftZhKTWohaihj9szaxwfKUT6FMMRGZ+0CehqeLNdDmRK1zz7HQHF3fFYtiGwjKHs3/ogpcJ5d7DmQIDAQABo1YwVDBSBgNVHR8ESzBJMEegRaBDhkFmaWxlOi8vL2hvbWUvcmVtb3RlL2ZyZW5hdWQvZnJlZWlwYS9zcmMvZnJlZWlwYS10b29scy9wa2kvY2ExLmNybDANBgkqhkiG9w0BAQsFAAOCAQEAAc7zG0FoL7gYWuKibInAzlCNIWQdDue0ZAslf1z6CNZzB3yN+4JOCQh6D7ostc1Ugo7BA+Mah2EgDvAVE1GgCZfNE0g1XjOaOHCBss7n/XBUS1OC/ktBcbd+dTC8kb9W1cWgQepRxg3WNovpH7LraMrRU4C0j3kfvmw1qh2I7bJaO0bzf756zAK1F3AlUQuQakN6n7KE7Uo4TSsq3FDAfKua4HUQTMVPVNp/iWXDDfh7IWPVhfcuau2gHbFIrWHYcirbQaPlJG/u9Nelhzl0/Ky5awrbuUwFS8iWz+0BjWjjT8a7eWeI2VXVCkiAKgKpnAlT/DaoYtj0H8WohHi73g==
ipa-server-install --domain ipa.test --realm IPA.TEST -a Secret123 -p Secret123 -U
echo Secret123 | kinit admin
ipa user-add testuser --first test --last user
ipa idview-add testview
ipa idoverrideuser-add testview testuser
ipa idoverrideuser-mod testview testuser --certificate=$CERT
ipa cert-find --certificate=$CERT

Expected result:

---------------------
1 certificate matched
---------------------
  Certificate: MIIDNjCCAh6gAwIBAgIBDzANBgkqhkiG9w0BAQsFADAsMR0wGwYDVQQKDBRFeGFtcGxlIE9yZ2FuaXphdGlvbjELMAkGA1UEAwwCQ0EwHhcNMjAxMTEzMTQxNzM3WhcNMjExMTEzMTQxNzM3WjA5MR0wGwYDVQQKDBRFeGFtcGxlIE9yZ2FuaXphdGlvbjEYMBYGA1UEAwwPY2xpZW50LmlwYS50ZXN0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxDbnMaPtDvwi7PRysBExSIIegDeilsUpXNrfRzPnlwFEkQou/fOR8VIHbOFlb4WjShh7bqprsTBTeD3wvdObB3bWAv2GROkmLFWAU1ry7GYObE1dtNvNGp0hYJsgkGoWgy5hO1Zjp67lfkR02TJoSiiciEt4EkvFpKmLmEM5+5ShVm5YMjBIrT4DZsgk0IfUVvu2Ocb3sNaJuUhK7BEF6R8tRFZC+yI/kBCvZESaq69yljVdVI4ky4Zx4NnoQK7PdledIFvRZftZhKTWohaihj9szaxwfKUT6FMMRGZ+0CehqeLNdDmRK1zz7HQHF3fFYtiGwjKHs3/ogpcJ5d7DmQIDAQABo1YwVDBSBgNVHR8ESzBJMEegRaBDhkFmaWxlOi8vL2hvbWUvcmVtb3RlL2ZyZW5hdWQvZnJlZWlwYS9zcmMvZnJlZWlwYS10b29scy9wa2kvY2ExLmNybDANBgkqhkiG9w0BAQsFAAOCAQEAAc7zG0FoL7gYWuKibInAzlCNIWQdDue0ZAslf1z6CNZzB3yN+4JOCQh6D7ostc1Ugo7BA+Mah2EgDvAVE1GgCZfNE0g1XjOaOHCBss7n/XBUS1OC/ktBcbd+dTC8kb9W1cWgQepRxg3WNovpH7LraMrRU4C0j3kfvmw1qh2I7bJaO0bzf756zAK1F3AlUQuQakN6n7KE7Uo4TSsq3FDAfKua4HUQTMVPVNp/iWXDDfh7IWPVhfcuau2gHbFIrWHYcirbQaPlJG/u9Nelhzl0/Ky5awrbuUwFS8iWz+0BjWjjT8a7eWeI2VXVCkiAKgKpnAlT/DaoYtj0H8WohHi73g==
  Subject: CN=client.ipa.test,O=Example Organization
  Issuer: CN=CA,O=Example Organization
  Not Before: Fri Nov 13 14:17:37 2020 UTC
  Not After: Sat Nov 13 14:17:37 2021 UTC
  Serial number: 15
  Serial number (hex): 0xF
----------------------------
Number of entries returned 1
----------------------------

Current result:

----------------------
0 certificates matched
----------------------
----------------------------
Number of entries returned 0
----------------------------